Skip to content
MozDef: Mozilla Enterprise Defense Platform
Branch: master
Clone or download
Latest commit 58bedf7 May 21, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
alerts Merge pull request #1264 from mozilla/create_excessive_describe_calls… May 14, 2019
benchmarking Fixup block comments not having a space after hash Dec 14, 2018
bot Specifically reconnect in slackbot exception Apr 9, 2019
cloudy_mozdef Remove reference to OIDCDiscoveryURL May 17, 2019
config Update missing references to alertactions in syslog configs Mar 21, 2019
cron Merge pull request #1232 from mozilla/use_index_wildcards May 6, 2019
docker removes dashboard version as this breaks kibana due to integer type b… May 20, 2019
docs Readd OPTIONS_METEOR_KIBANAURL May 14, 2019
examples Merge branch 'master' into themed-css Mar 28, 2019
loginput Fixup unused variables check Dec 14, 2018
meteor Merge remote-tracking branch 'origin/master' into testing_kibanaurl May 15, 2019
mozdef_util Use wildcard in indices for searching Apr 24, 2019
mq Remove unused comments from mq plugins May 2, 2019
rest Remove full kibanaurl from rest api May 13, 2019
static removing path to watchlist, removing watchlist from static, adding pr… Oct 30, 2018
systemdfiles Fixup remaining mozdefalertplugin references Mar 22, 2019
tests Merge remote-tracking branch 'origin/master' into testing_kibanaurl May 14, 2019
.flake8 Exclude mozdef_util build directory from flake8 checks Apr 9, 2019
.gitignore resolving merge from master conflicts Nov 16, 2018
.travis.yml Define python version for Travis Apr 8, 2019
CHANGELOG Merge pull request #1106 from mozilla/add_index_open_and_close_abstra… Apr 10, 2019
CODEOWNERS Update codeowners to include admin set for all clauses May 14, 2019 Add Mozilla Code of Conduct file Mar 28, 2019 Modifying urls to point to mozilla from jeffbryner, slight readabilit… Jun 15, 2017
LICENSE Updated license file to conform with MPL Feb 25, 2014
Makefile parallel build May 10, 2019 Changes Click with Caution to Warning May 10, 2019
requirements.txt multiple fixes May 10, 2019

Build Status Documentation Status

MozDef: Mozilla Enterprise Defense Platform


Give MozDef a Try in AWS:

The following button will launch the Mozilla Enterprise Defense Platform in your AWS account.

Warning: Pressing the "Launch Stack" button and following through with the deployment will incur charges to your AWS account.

Launch MozDef


The inspiration for MozDef comes from the large arsenal of tools available to attackers. Suites like metasploit, armitage, lair, dradis and others are readily available to help attackers coordinate, share intelligence and finely tune their attacks in real time. Defenders are usually limited to wikis, ticketing systems and manual tracking databases attached to the end of a Security Information Event Management (SIEM) system.

The Mozilla Enterprise Defense Platform (MozDef) seeks to automate the security incident handling process and facilitate the real-time activities of incident handlers.


  • Provide a platform for use by defenders to rapidly discover and respond to security incidents.
  • Automate interfaces to other systems like bunker, cymon, mig
  • Provide metrics for security events and incidents
  • Facilitate real-time collaboration amongst incident handlers
  • Facilitate repeatable, predictable processes for incident handling
  • Go beyond traditional SIEM systems in automating incident handling, information sharing, workflow, metrics and response automation


MozDef is in production at Mozilla where we are using it to process over 300 million events per day.

You can’t perform that action at this time.